MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 90039768c0de73c07a511aa6eb560df1e33f41bbe3b6753ddbcf6ffc07711169. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Pony
Vendor detections: 8
| SHA256 hash: | 90039768c0de73c07a511aa6eb560df1e33f41bbe3b6753ddbcf6ffc07711169 |
|---|---|
| SHA3-384 hash: | 5847448d0319818c8d175a7c3fc068fa960a37faeddf60c5f6f54da0c751b219cad9040faba0d05917b13059a2109e25 |
| SHA1 hash: | d6e32bbc6e9bef278c776f9cc34f267888277787 |
| MD5 hash: | e3bbd3c753df17e7b8392a82330a2bb6 |
| humanhash: | september-summer-eight-michigan |
| File name: | KPAW.exe |
| Download: | download sample |
| Signature | Pony |
| File size: | 560'128 bytes |
| First seen: | 2020-06-26 11:38:38 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4efaaf21b12695f01a3026d85b9437a9 (5 x AgentTesla, 5 x Loki, 2 x FormBook) |
| ssdeep | 12288:pEWYuBQgNo1MTuOxYL1ITsHwDUyt3EewwniNRzxbW3:qtIouYueWd3EvZg |
| Threatray | 146 similar samples on MalwareBazaar |
| TLSH | 2FC49F22E2E14833C052157D9C3BD6785A2ABD513D695A4F2BF4FD0C5F34E81392A2B7 |
| Reporter |  abuse_ch |
| Tags: | exe Pony |
abuse_ch
Malspam distributing Pony:HELO: slot0.mcleeria.com
Sending IP: 45.95.169.81
From: "CMP Company (Taiwan) Limited" <info@mcleeria.com>
Subject: Quote-PO 64775 Attached
Attachment: PO 64774.rar (contains "KPAW.exe")
Pony C2:
http://globalex.uz/rot/panelnew/gate.php
Intelligence
File Origin
# of uploads :
1
# of downloads :
458
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Fareit
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Reading critical registry keys
Connection attempt
Sending an HTTP POST request
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Stealing user critical data
Brute forcing passwords of local accounts
Threat name:
Win32.Trojan.FormBook
Status:
Malicious
First seen:
2020-06-26 11:40:08 UTC
AV detection:
27 of 31 (87.10%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
pony
icedid
Similar samples:
+ 136 additional samples on MalwareBazaar
Result
Malware family:
pony
Score:
10/10
Tags:
spyware discovery rat stealer family:pony
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Checks for installed software on the system
Deletes itself
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Pony,Fareit
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.